NEWS FROM THE LAB - Wednesday, June 16, 2004

Two variants of Cabir sent to AV companies Posted by Jarno @ 10:10 GMT

Today we received another variant of Cabir trough sample exhange from other vendor.
It seems that Cabir author has sent different versions of the worm to different AV vendors.

We have named this new variant as Cabir.B, even as it may have been sent before the sample
that we call Cabir.A. Cabir.B seems to be functionally identical to Cabir.A except that it shows
different text on activation.

We have tested the Cabir worms on all Symbian Series 60 devices that we have got access to,
it seems to be able to infect any Series 60 device we have tested it on, regardless of the manufacturer.

Neither of the variants have been found in the wild so far.

A description of Cabir.B https://www.f-secure.com/v-descs/cabir_b.shtml